Currently, when users try to run CI locally (currently with mock_runner),
if their project has a secret dependency they have to either write a local
secrets file, or to temporary modify their environment.yaml.

The file format should have support for default behavior in case a secret
was not found. Maybe something similar to: